Microsoft Cloud PKI support for US Government GCC High

What changed

You can create and manage a cloud-based public key infrastructure that automates certificate issuance, renewal, and revocation for Intune-managed devices without deploying an on-premises certification authority, Network Device Enrollment Service, or Intune Certificate Connector for device certificate delivery. Use these certificates for certificate-based authentication to organizational resources such as Wi-Fi, VPN, and applications.

Why it matters

Cloud PKI in GCC High can replace on-premises certificate-delivery components for managed devices, but trust, issuance and revocation paths remain security-critical.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Confirm GCC High licensing, roles and supported certificate use cases
• Build a pilot issuing CA and deploy Wi-Fi or VPN certificates to test devices
• Validate trust chains, renewal, revocation, audit and emergency rollback